Instructor: In this lesson,
we're going to talk about boot options
that are set inside of your BIOS or UEFI.
Now the BIOS or basic input/output system is the program
that a personal computer's microprocessor is going to use
to get that computer system started and booted up
after you turn it on.
This BIOS is also going to manage the data flow
between the computer's operating system
and the attached devices such as the storage devices
like a hard disk drive, or solid-state drive,
a video adapter, the keyboard and the printer.
This is the most common example of firmware
or software on a chip
and it is the first software that's run by the computer
whenever you power on the machine.
Now the BIOS has several roles
including performing the power-on self-test
which is going to test and initialize the processor,
videocard, disk drives and adapters,
as well as configuring the hardware of your system
and setting up the proper boot order
to execute when that system is first powered on.
The BIOS is stored in ROM and ROM is read-only memory.
This is a type of chip
that is actually embedded into your motherboard
but it can be upgraded through a process known as flashing.
The BIOS is also a program inside of this chip
and that program allows the user
to make changes to the settings
and those settings are going to be saved
in something known as the CMOS.
The CMOS is the complementary metal-oxide semiconductor
and it's a battery-powered memory chip.
This is a non-volatile type of memory
that stores the BIOS settings
and it's built into the motherboard.
As long as the battery power remains,
the DC current is going to be provided to the CMOS
and this allows the settings to be retained
by that motherboard and by that BIOS.
If the computer is constantly losing its settings
or forgetting the date and time,
this is usually an indication
that that battery needs to be replaced.
This battery normally lasts about three years.
But on newer CMOSs,
these can actually use an internal lithium-ion battery
that can last up to 10 years.
The most typical external battery
that's going to be used with these CMOSs
is known as the CR2032
and this looks like a watch battery.
Now remember, if the battery begins to fail,
the first thing the user is going to notice
is that that system clock
is going to forget the date and time frequently.
So if you find yourself changing your date and time a lot,
this indicates that your battery is most likely dying.
Now when you press the power button on your computer,
the first thing that happens when power is applied
is we begin the boot process
and the first step is the power-on self-test
which is known as the POST.
The power-on self-test is a diagnostic testing sequence
that a computer's basic input/output system
or the starting program
is going to run to determine if the computer's keyboard,
RAM, disk drives, storage devices and other hardware
are all working properly.
If the necessary hardware is detected
and it's found to be operating properly,
that computer can then begin to boot up.
If the hardware is not detected
or it's found to not be operating properly,
the BIOS will issue an error message
which could be a text message on your screen.
Or if your screen is having a problem,
it could be a series of coded beeps
depending on the nature of your specific problem.
Since the POST
runs before the computer's video card is activated,
it may not be possible to display everything to your screen.
And therefore, we're going to use these variable beeps
as a way to tell you what's wrong with the system.
These beeps can be short and long
or a mixture of short and long beeps
depending on what type of BIOS is installed
by your motherboard.
The exact pattern of beeps is going to contain messages
about the nature of the problem that it found.
For example, if the keyboard is not detected,
a particular pattern of beeps might inform you of that
by sending two short and one long beep,
something like beep, beep, boop.
Now the POST can also have errors that are fatal.
And if this is the case,
it'll cause the current program to stop running
and it will halt the boot process.
This is important to understand
because the hardware that's being checked by this POST test
is all the essential hardware,
things like your memory, your keyboard,
your input/output devices and your processor.
So if there's any error in any of these things,
it will stop the boot process because it can't go
and load a full operating system
with faulty hardware.
Now once your POST does successfully happen,
this will then allow the BIOS
to read the settings from the CMOS
and the BIOS will then look for an operating system
from your configured boot devices.
The BIOS also has its own low-level operating system
of sorts for that computer
which allows it to take input
and give output to the most basic components
including your keyboard, your disk drives,
and the video display.
Using its low-level ability to read from the storage device,
the BIOS will then try to find
your installed operating system,
something like Windows or Linux or Mac OS.
And then, the operating system's bootloader
is going to begin the operating system boot up process
and turns over control the computer
over to that operating system.
Now the BIOS also stores its settings and configurations
in the CMOS like I said before
but you're probably wondering,
how do you change those settings?
Well, to configure those settings inside of the CMOS,
you need to enter the BIOS configuration environment.
To do this, you're going to be pressing a valid key
or combination keys during the boot up process
and this is going to be set up
by your manufacturer of your BIOS.
The most commonly used keys for this is F2 or Delete
but this does vary depending on the BIOS
and the motherboard that you're using
and I've seen other keys like the Escape key, F1,
F10 and F12 being used.
Usually, when you first turn on the system,
there will be a message on your screen
that will tell you which keystroke is required
in order to change its configuration settings.
If you don't see that displayed,
you can simply do a quick search online
at the manufacturer's website
and this will tell you which keystroke is being used
by your particular system.
Now traditionally, there was only a single type of BIOS
which relied fully on a text-based menu system
and a keyboard as its system of input.
This traditional BIOS provided the user with the ability
to view information on memory, CPU,
optical drives and storage devices.
While these weren't very graphically appealing,
these text-based systems
did provide all the necessary functionality
in order to configure your device, your boot order,
your clock speeds, the date, the time,
whether or not you're going to enable virtualization support,
security features and lots of other things like that.
Now modern systems though
have started switching over from this traditional BIOS
and instead are using something known as the UEFI.
Now the UEFI or UEFI as we like to call it
is the Unified Extensible Firmware Interface
and it's basically an updated form of BIOS
that allows both the keyboard and mouse as input,
as well as providing a graphical user interface
instead of that standard text-based menu.
These systems tend to be more intuitive for you to use
because they have that graphical user interface
instead of a text-based menu system
and they still provide all the necessary functionality
to configure your devices, your boot order,
your clock speeds, your date and time,
the virtualization support options, security features,
and lots of other things including rates.
Now some of these UEFI-based systems
also include software in them
that will allow you to go online,
play some basic games,
and even use backup programs
without ever having to enter into a normal operating system
like Windows, Linux or Mac OS,
and this makes them very powerful.
Now UEFI has several advantages over the traditional BIOS.
First, the traditional BIOS only operates
as a 32-bit system
whereas UEFI can support 64-bit systems.
Second, UEFI can support larger hard disk drives
and solid-state devices.
The traditional BIOS can only support storage devices
up to 2.2 terabytes in size
but the UEFI can support drives
up to 9.4 zettabytes in size.
That is 9.4 times 10 to the 21st bytes.
That would be a an extremely large drive.
And right now, none of those actually exist.
But for this reason,
UEFI gives us lots of capability well into the future.
The third thing we have is that the traditional BIOS
only supports using a master boot record
which is known as an MBR
and this is your storage device partition table
that tells you how the things are stored
on your given hard drive or solid-state device.
But UEFI can actually support the newer GUID
or GUID partition table format
which is known as the GPT.
Now this new format of GPT supports larger hard disks
and storage devices as required for any device
that is going to be larger than 2.2 terabytes in size.
Fourth, the UEFI tends to be faster than a traditional BIOS
in terms of booting up a system.
So this is another increased benefit for us.
And fifth, the UEFI usually uses a larger size ROM
than a traditional BIOS.
And so it can actually support more complicated programs
including that GUI-based configuration tool
that we talked about earlier
that's included with most UEFI-based systems
and this gives you better diagnostic tools and commands
that you can use during your troubleshooting.
Now, regardless of whether you're going to use
a traditional BIOS or a newer UEFI-based system,
you're going to be using this configuration tool
to set up the boot order and the parameters for your system.
This will allow you to determine
which devices are going to be read from
when you're trying to find the operating system,
such as Windows, Linux or Mac OS
for the system to be able to load.
This can be your fixed storage device,
something like a hard disk drive or a solid-state device.
But you could also store it on an optical drive
like a CD, DVD or Blu-ray,
or a USB drive like a thumb drive or flash drive,
or you might even use a network adapter
to reach out to a server using the pre-execution environment
known as PXE as your desired boot option.
All of these are valid choices
and it does depend on your use case.
So it's an important thing for you to configure
inside of your BIOS or UEFI
as you pick out the prioritized list
or boot order that you want to use.
For example, let's say you have your set up
to be the optical drive first,
then the hard disk, then the USB,
and then finally the network.
This means when you turn on your computer,
the system is first going to look to your optical drive
to see if it can find a bootable operating system there.
If it does, it's going to load it up.
But if it doesn't, it's going to move on
to your second priority
which we listed as the hard disk drive.
Now when it looks at your hard drive,
it might find that Windows is installed.
So it's going to then load up Windows
and turn over control the system
to the Windows operating system
and it won't go any further down its boot list.
But this particular order can actually be dangerous for you
because there's a lot of operating systems out there
that can be run from an optical drive or a USB thumb drive,
such as certain versions of Linux.
So as an attacker,
if I can insert my Kali Linux DVD into your optical drive
and power on your computer,
I can now use your hardware
and be able to bypass all of your passwords
because I'm now loading up Kali Linux instead of Windows,
and so I don't need to hack into your Windows account
to use your system anymore.
At this point from inside Kali Linux,
I can mount your hard drive
to read your files and things like that.
But again, I would have to have physical access
to your system to put that DVD into your drive.
So for this reason, in most corporate environments,
we like to use the best practice of disabling booting
from an optical drive or USB drive to prevent attackers
from taking over your systems in this way.
Instead, you should configure your system
to boot from your installed hard drive
using the operating system you installed.
Or if you're using a thin client,
you may choose to boot the operating system over the network
using PXE as your primary option
and then not selecting optical drives or USB drives at all
inside of your priority list.
Now the final thing we need to discuss
with the BIOS and UEFI
is how to update it because this is software after all
even if it is software on a chip or firmware.
Now to update the BIOS or UEFI,
you need to use a process known as flashing.
Flashing is performed whenever there are upgrades,
security fixes or feature improvements
that need to be made to the BIOS or UEFI codebase.
Always check the manufacturer's website
for the latest firmware version
and their specific process
for flashing your BIOS or UEFI.
In the old days,
our systems actually didn't have the ability
to flash the BIOS.
And instead, we had to actually replace
the entire BIOS chip on the motherboard.
But thankfully, all modern motherboards
now support flashing
so we can simply overwrite the BIOS or UEFI
using this specialized procedure.
Now before flashing the BIOS or the UEFI,
you should always backup your configuration
and information first,
just in case something does go wrong.
In most systems,
you're going to need a USB flash drive
to flash your firmware.
You'll then load a file into the root
of that USB flash drive,
connect the flash drive
to the specified USB port on your motherboard,
and then reboot the system
while pressing a series of specified keys
or pushing a specific button
on the back of your motherboard.
Then, the BIOS or UEFI will take over,
copy the firmware to the system,
and overwrite its old code
with that newly updated firmware code.